I'd like to deploy a Canvas Connected App as part of a managed package and be able to dynamically assign users access to it via a Permission Set.
The Canvas App is using the Signed Request (Post) access method.
Under Manage Apps > Connected Apps > OAuth policies the Permitted Users have been set to "Admin approved users are pre-authorized". On the same screen a Permission Set has been added to the Connected App.
When the Permission Set and Canvas App are deployed as part of a managed package the Permitted Users resets to "All users may self-authorize" in the installing org.
After manually changing Permitted Users to "Admin approved users are pre-authorized" in the target org and attempting to add the managed permission set back to the Connected App I get the error:
Cannot Modify Managed Component
The component you are attempting to modify is part of a managed package, and cannot be modified. For more information, see Insufficient Privileges Errors.
Is this an explicit security restriction to ensure managed packages don't automatically grant users access?
I.e. Only an Admin in the local org can grant access to the App.
Based on App disappears from Permission Set included with package it appears to be a limitation of the packaging process rather than a specific security control.
From Special Behavior of Components in Packages
Permission Sets
You can include permission sets as components in a package, with the following permissions and access settings:
- Custom object permissions
...- External data source access
Note
Assigned apps and tab settings are not included in permission set components.
So the assigned apps aren't carried over on the permission set currently.
The idea Maintain App and Tab settings for Permission Sets in Managed Packages would be worth promoting.
That leaves the question - How can a managed package control user access to the deployed Connected App?
Maybe if the installing Admin creates a new Permission Set and configures it against the Connected app as a manual post install step. Then the Id of the Permission Set that grants access could be configured into the managed package for creating the PermissionSetAssignment records.
isAdminApproved
, which whentrue
mean's your Permitted Users setting is set to Admin approved. Interestingly enough, in the metadata, when you change from Admin approved to User approved,isAdminApproved
changes to false and the metadata item<permissionSetName>My Connected App User</permissionSetName>
also disappears. The reason why permission sets don't carry over is because the User approved setting is defaulted, which clears out the assigned permission setsisAdminApproved
attribute in the ConnectedApp Metadata Docs